Merge pull request #14558 from FortiNDR-Integration/FortiNDR-Cloud-Sentinel-data-collection-api-retirement

Refactoring Post Data to use the new LogIngestion Client

Author: v-atulyadav

Solutions/Fortinet FortiNDR Cloud/Data Connectors/FortinetFortiNdrCloud_API_AzureFunctionApp.json

@@ -107,43 +107,28 @@
         },
         {
             "title": "",
-            "description": ">**(Optional Step)** Securely store **Azure Client Secret** and **API authorization key(s) or token(s)** in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
+            "description": ">**(Optional Step)** Securely store **API authorization key(s) or token(s)** in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
         },
         {
             "title": "",
             "description": ">**NOTE:** This connector uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Fortinet%20FortiNDR%20Cloud/Parsers/Fortinet_FortiNDR_Cloud.md) to create the Kusto function alias **Fortinet_FortiNDR_Cloud**."
         },
         {
-            "description": "**STEP 1 - Prerequisites & App Registration**\n\nEnsure you have registered an identity application in your Microsoft Entra / Azure Active Directory tenant and granted it the necessary REST API execution permissions. Generate the credentials (Client Secret). You will need the **Azure Tenant ID**, **Azure Client ID**, and a valid **Azure Client Secret** to complete the custom template deployment form."
-        },
-        {
-            "description": "**STEP 2 - Deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Fortinet FortiNDR Cloud connector, have the **Azure Tenant ID**, **Azure Client ID**, and **Azure Client Secret** from Step 1, as well as the values below, readily available.",
+            "description": "**STEP 1 - Deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Fortinet FortiNDR Cloud connector, have the value below, readily available.",
             "instructions": [
                 {
                     "parameters": {
                         "fillWith": [
-                            "workspaceName"
-                        ],
-                        "label": "Workspace Name"
-                    },
-                    "type": "CopyableLabel"
-                },
-                {
-                    "parameters": {
-                        "fillWith": [
-                            "TenantId"
+                            "WorkspaceId"
                         ],
-                        "label": "Azure Tenant ID"
+                        "label": "Workspace ID"
                     },
                     "type": "CopyableLabel"
                 }
             ]
         },
         {
-            "description": "**STEP 3 - Azure Resource Manager (ARM) Template**\n\nUse this method for automated deployment of the Fortinet FortiNDR Cloud connector.\n\n1. Click the **Deploy to Azure** button below.\n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-FortinetFortiNDR-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**.\n3. Enter the **workspace**, **AzureTenantID**, **AzureClientID**, and **AzureClientSecret**.\n4. Click **Create** to deploy."
-        },
-        {
-            "description": "**STEP 4 - After the connector is deployed, go to the Data Collection Rule and search for the dcr-fortinetfortindrcloud. Select Access control (IAM) and assign the Monitoring Metrics Publisher role to the integration App registration (use the display name when looking for the members).**"
+            "description": "**STEP 2 - Azure Resource Manager (ARM) Template**\n\nUse this method for automated deployment of the Fortinet FortiNDR Cloud connector.\n\n1. Click the **Deploy to Azure** button below.\n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-FortinetFortiNDR-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**.\n3. Click **Create** to deploy."
         }
         ]
 }

Solutions/Fortinet FortiNDR Cloud/Data Connectors/azuredeploy_FortinetFortiNdrCloud_API_FunctionApp.json

@@ -61,27 +61,6 @@
             ],
             "type": "Int"
         },
-        "AzureClientID": {
-            "type": "string",
-            "minLength": 1,
-            "metadata": {
-                "description": "Enter Azure Client ID that you have created during app registration"
-            }
-        },
-        "AzureClientSecret": {
-            "type": "securestring",
-            "minLength": 1,
-            "metadata": {
-                "description": "Enter Azure Client Secret for your app registration"
-            }
-        },
-        "AzureTenantID": {
-            "type": "string",
-            "minLength": 1,
-            "metadata": {
-                "description": "Enter Azure Tenant ID"
-            }
-        },
         "AwsAccessKeyId": {
             "type": "string",
             "defaultValue": "<AwsAccessKeyId>"
@@ -164,19 +143,36 @@
     },
     "resources": [
         {
-            "type": "Microsoft.OperationalInsights/workspaces/tables",
-            "apiVersion": "2022-10-01",
-            "name": "FortinetFortiNdrCloudRaw_CL",
-            "scope": "[tenantResourceId(subscription().subscriptionId, parameters('workspaceResourceGroup'), 'Microsoft.OperationalInsights/workspaces', parameters('workspace'))]",
+            "type": "Microsoft.Resources/deployments",
+            "apiVersion": "2022-09-01",
+            "name": "deploy-fortinet-table",
+            "resourceGroup": "[parameters('workspaceResourceGroup')]",
             "properties": {
-                "retentionInDays": 30,
-                "totalRetentionInDays": 30,
-                "schema": {
-                    "name": "FortinetFortiNdrCloudRaw_CL",
-                    "columns": [
-                        { "name": "TimeGenerated", "type": "datetime" },
-                        { "name": "LogTypeSuffix", "type": "string" },
-                        { "name": "RawData", "type": "string" }
+                "mode": "Incremental",
+                "expressionEvaluationOptions": {
+                    "scope": "outer"
+                },
+                "template": {
+                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                    "contentVersion": "1.0.0.0",
+                    "resources": [
+                        {
+                            "type": "Microsoft.OperationalInsights/workspaces/tables",
+                            "apiVersion": "2022-10-01",
+                            "name": "[concat(parameters('workspace'), '/FortinetFortiNdrCloudRaw_CL')]",
+                            "properties": {
+                                "retentionInDays": 30,
+                                "totalRetentionInDays": 30,
+                                "schema": {
+                                    "name": "FortinetFortiNdrCloudRaw_CL",
+                                    "columns": [
+                                        { "name": "TimeGenerated", "type": "datetime" },
+                                        { "name": "LogTypeSuffix", "type": "string" },
+                                        { "name": "RawData", "type": "string" }
+                                    ]
+                                }
+                            }
+                        }
                     ]
                 }
             }
@@ -196,7 +192,7 @@
             "name": "dcr-FortinetFortiNdrCloud",
             "location": "[parameters('location')]",
             "dependsOn": [
-                "[tenantResourceId(subscription().subscriptionId, parameters('workspaceResourceGroup'), 'Microsoft.OperationalInsights/workspaces/tables', parameters('workspace'), 'FortinetFortiNdrCloudRaw_CL')]",
+                "[resourceId('Microsoft.Resources/deployments', 'deploy-fortinet-table')]",
                 "[resourceId('Microsoft.Insights/dataCollectionEndpoints', 'dce-fortinet-fortindr-cloud')]"
             ],
             "properties": {
@@ -330,7 +326,6 @@
                     }
                 },
                 "siteConfig": {
-                    "packageUri": "https://aka.ms/sentinel-fortinetFortiNdrCloudDataConnector-functionapp",
                     "appSettings": [
                         {
                             "name": "AzureWebJobsStorage__accountName",
@@ -368,18 +363,6 @@
                             "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
                             "value": "[reference(resourceId('microsoft.insights/components', variables('applicationInsightsName')), '2020-02-02').ConnectionString]"
                         },
-                        {
-                            "name": "TENANT_ID",
-                            "value": "[parameters('AzureTenantID')]"
-                        },
-                        {
-                            "name": "CLIENT_ID",
-                            "value": "[parameters('AzureClientID')]"
-                        },
-                        {
-                            "name": "CLIENT_SECRET",
-                            "value": "[parameters('AzureClientSecret')]"
-                        },
                         {
                             "name": "DceUri",
                             "value": "[reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', 'dce-fortinet-fortindr-cloud'), '2022-06-01').logsIngestion.endpoint]"
@@ -513,6 +496,63 @@
                 "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
                 "principalId": "[reference(resourceId('Microsoft.Web/sites', parameters('functionAppName')), '2016-08-01', 'Full').identity.principalId]"
             }
+        },
+        {
+            "type": "Microsoft.Authorization/roleAssignments",
+            "apiVersion": "2022-04-01",
+            "name": "[guid(resourceId('Microsoft.Insights/dataCollectionRules', 'dcr-FortinetFortiNdrCloud'), 'monitoring-metrics-publisher')]",
+            "scope": "[resourceId('Microsoft.Insights/dataCollectionRules', 'dcr-FortinetFortiNdrCloud')]",
+            "dependsOn": [
+                "[resourceId('Microsoft.Insights/dataCollectionRules', 'dcr-FortinetFortiNdrCloud')]",
+                "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]"
+            ],
+            "properties": {
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                "principalId": "[reference(resourceId('Microsoft.Web/sites', parameters('functionAppName')), '2023-12-01', 'Full').identity.principalId]"
+            }
+        },
+        {
+            "type": "Microsoft.Resources/deploymentScripts",
+            "apiVersion": "2020-10-01",
+            "name": "WaitSection",
+            "location": "[parameters('location')]",
+            "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]"
+            ],
+            "kind": "AzurePowerShell",
+            "properties": {
+                "azPowerShellVersion": "7.0",
+                "scriptContent": "start-sleep -Seconds 30",
+                "cleanupPreference": "Always",
+                "retentionInterval": "PT1H"
+            }
+        },
+        {
+            "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+            "apiVersion": "2020-08-01",
+            "name": "[format('{0}/Fortinet_FortiNDR_Cloud', parameters('workspace'))]",
+            "location": "[parameters('location')]",
+            "dependsOn": [
+                "[resourceId('Microsoft.Resources/deployments', 'deploy-fortinet-table')]"
+            ],
+            "properties": {
+                "category": "Microsoft Sentinel Parser",
+                "displayName": "Parser for Fortinet_FortiNDR_Cloud",
+                "functionAlias": "Fortinet_FortiNDR_Cloud",
+                "query": "let FortiNDR_Cloud_suricata_view = view () { FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'suricata' or column_ifexists('event_type', '') == 'suricata' | extend parsed = parse_json(column_ifexists('RawData', '{}')) | extend su_timestamp=coalesce(todatetime(tostring(parsed.timestamp)), TimeGenerated), su_uuid=tostring(parsed.uuid), su_event_type=coalesce(tostring(parsed.event_type), 'suricata'), su_customer_id=tostring(parsed.customer_id), su_sensor_id=tostring(parsed.sensor_id), su_source=tostring(parsed.source), su_src_ip=tostring(parsed.src_ip), su_src_port=todouble(parsed.src_port), su_dst_ip=tostring(parsed.dest_ip), su_dst_port=todouble(parsed.dest_port), su_proto=tostring(parsed.proto), su_sig_id=todouble(parsed.alert.signature_id), su_sig_rev=todouble(parsed.alert.rev), su_sig_name=tostring(parsed.alert.signature), su_sig_category=tostring(parsed.alert.category), su_sig_severity=todouble(parsed.alert.severity), Type='FncEventsSuricata_CL' | project TimeGenerated, su_timestamp, su_event_type, su_src_ip, su_src_port, su_dst_ip, su_dst_port, su_sig_name, su_sig_id, su_sig_rev, su_sig_category, su_sig_severity, su_source, su_proto, su_sensor_id, su_uuid, su_customer_id, Type }; let FortiNDR_Cloud_observation_view = view () { FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'observation' or column_ifexists('event_type', '') == 'observation' | extend parsed = parse_json(column_ifexists('RawData', '{}')) | extend ob_timestamp=coalesce(todatetime(tostring(parsed.timestamp)), TimeGenerated), ob_uuid=tostring(parsed.uuid), ob_event_type=coalesce(tostring(parsed.event_type), 'observation'), ob_customer_id=tostring(parsed.customer_id), ob_sensor_id=tostring(parsed.sensor_id), ob_source=tostring(parsed.source), ob_observation_title=tostring(parsed['title']), ob_confidence=tostring(parsed.confidence), ob_src_ip=tostring(parsed.src_ip), ob_dst_ip=tostring(parsed.dst_ip), Type='FncEventsObservation_CL' | project TimeGenerated, ob_timestamp, ob_observation_title, ob_confidence, ob_event_type, ob_src_ip, ob_dst_ip, ob_source, ob_sensor_id, ob_uuid, ob_customer_id, Type }; let FortiNDR_Cloud_detections_view = view () { FortinetFortiNdrCloudRaw_CL | where LogTypeSuffix == 'detections' or LogTypeSuffix == 'detection' or column_ifexists('event_type', '') == 'detection' | extend parsed = parse_json(column_ifexists('RawData', '{}')) | extend de_account_id=tostring(parsed.account_uuid), de_device_ip=tostring(parsed.device_ip), de_rule_name=tostring(parsed.rule_name), de_severity=tostring(parsed.rule_severity), de_confidence=tostring(parsed.rule_confidence), de_sensor_id=tostring(parsed.sensor_id), de_created=coalesce(todatetime(tostring(parsed.created)), TimeGenerated), de_uuid=tostring(parsed.uuid), de_status=tostring(parsed.status), de_category=tostring(parsed.rule_category), Type='FncEventsDetections_CL' | project TimeGenerated, de_device_ip, de_status, de_rule_name, de_severity, de_confidence, de_category, de_created, de_sensor_id, de_account_id, de_uuid, Type }; union isfuzzy=true FortiNDR_Cloud_suricata_view, FortiNDR_Cloud_observation_view, FortiNDR_Cloud_detections_view"
+            }
+        },
+        {
+            "type": "Microsoft.Web/sites/extensions",
+            "apiVersion": "2022-09-01",
+            "name": "[format('{0}/{1}', parameters('functionAppName'), 'onedeploy')]",
+            "dependsOn": [
+                "[resourceId('Microsoft.Resources/deploymentScripts', 'WaitSection')]"
+            ],
+            "properties": {
+                "packageUri": "https://aka.ms/sentinel-fortinetFortiNdrCloudDataConnector-functionapp",
+                "remoteBuild": true
+            }
         }
     ]
 }

Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn.zip

@@ -57,14 +57,11 @@
 
 
 def validate_credentials():
-    tenant_id = (os.environ.get("TENANT_ID") or "").strip()
-    client_id = (os.environ.get("CLIENT_ID") or "").strip()
-    client_secret = (os.environ.get("CLIENT_SECRET") or "").strip()
     endpoint = (os.environ.get("DceUri") or "").strip()
 
-    if not tenant_id or not client_id or not client_secret or not endpoint:
+    if not endpoint:
         raise InputError(
-            "Sentinel Infrastructure Information is missing. Provide (Tenant ID, Client ID, Client Secret and Data Collection Endpoint).")
+            "Sentinel Infrastructure Information is missing. Provide (Log Ingestion endpoint URI).")
 
 
 def validate_configuration():

Solutions/Fortinet FortiNDR Cloud/Data Connectors/fortinetFortiNdrCloudDataConn/OrchestratorWatchdog/__init__.py

@@ -4,23 +4,15 @@
 from datetime import datetime, timezone
 
 from azure.core.exceptions import ClientAuthenticationError, HttpResponseError
-from azure.identity import ClientSecretCredential
+from azure.identity import ManagedIdentityCredential
 from azure.monitor.ingestion import LogsIngestionClient
 
 try:
-    AZURE_TENANT_ID = (os.environ.get("TENANT_ID") or "").strip()
-    AZURE_CLIENT_ID = (os.environ.get("CLIENT_ID") or "").strip()
-    AZURE_CLIENT_SECRET = (os.environ.get("CLIENT_SECRET") or "").strip()
     AZURE_ENDPOINT = (os.environ.get("DceUri") or "").strip()
 
     logging.info("Initializing Azure Global Clients at startup.")
 
-    # (Assuming AZURE_CLIENT_ID, etc. are defined above or pulled from os.environ)
-    GLOBAL_CREDS = ClientSecretCredential(
-        client_id=AZURE_CLIENT_ID,
-        client_secret=AZURE_CLIENT_SECRET,
-        tenant_id=AZURE_TENANT_ID,
-    )
+    GLOBAL_CREDS = ManagedIdentityCredential()
 
     GLOBAL_CLIENT = LogsIngestionClient(
         endpoint=AZURE_ENDPOINT,
@@ -78,9 +70,7 @@ def post_data(events: list[dict], log_type_suffix: str):
 
     except ClientAuthenticationError as exc:
         logging.error(
-            f"{log_type_suffix} : Authentication failed - verify CLIENT_ID, "
-            f"CLIENT_SECRET, TENANT_ID, and that the App Registration has "
-            f"'Monitoring Metrics Publisher' role assigned on the DCR. Error: {exc}"
+            f"{log_type_suffix} : Authentication failed - verify the 'Monitoring Metrics Publisher' role assigned on the DCR. Error: {exc}"
         )
         raise
     except HttpResponseError as e: